Monthly
Arbitrary code execution on Windows in draw.io Desktop 31.4.5 and earlier stems from the Electron shell launching `powershell` and `attrib` by bare executable name, letting Windows resolve a same-named file from the diagram's own folder instead of System32. Exploitation requires the victim to extract an attacker-supplied archive and cold-open its legitimate `.drawio` file from that directory (the app must not already be running), with the powershell path firing when Local Fonts are enabled and the attrib path firing when draft or backup attributes are updated. The advisory publishes manual reproduction steps, so a public PoC reference exists; it is not verified as working exploit code, and there is no KEV entry or active-exploitation signal. Version 31.5.2 fixes the issue by invoking system binaries via absolute System32 paths, switching to `execFile`, and setting `NoDefaultCurrentDirectoryInExePath`; CVSS is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Authenticated users of pgAdmin 4 in server (multi-user web) mode can achieve arbitrary code execution as the operating-system account running pgAdmin by uploading an executable into a shared-storage directory and then pointing their own utility binary-path preference at it. The flaw affects releases before 9.19: the preference validator refused paths under the per-user STORAGE_DIR but never checked the SHARED_STORAGE directories that ordinary users can write to, so pg_dump, pg_restore, pg_dumpall or psql were launched from an attacker-controlled file. Practical exploitation is gated: the attacker needs a valid pgAdmin account and at least one non-restricted shared storage directory, and it is decisive on Windows server mode, where a file with an executable name runs, whereas on POSIX files created through pgAdmin are not executable - no public exploit was identified at time of analysis, and the CVSS 4.0 base of 7.7 (assessed as CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects those prerequisites rather than a network-wide, unauthenticated attack.
Local privilege escalation in Veeam Agent for Linux 13.1 allows a local low-privileged user to gain elevated privileges on hosts whose agent installation is managed by a Veeam Backup & Replication instance; standalone/unmanaged deployments are not affected. The flaw is an untrusted search path (CWE-426), the vendor has released a fix in 13.1.2, and no public exploit identified at time of analysis. This is a genuine but moderate-priority issue rather than an emergency.
Arbitrary code execution in DeepSeek Harness (dsh) at commit c291e796 stems from an untrusted search path weakness, letting an attacker plant a crafted executable in a location dsh consults when resolving content, so that the malicious file is run in place of the legitimate one. Exploitation is not automatic: per our independent assessment the attacker first needs write access to a searched directory (or control of a shared/current working directory) and then must induce a victim to open or run the substituted content, so the realistic vector is local with user interaction (AV:L/UI:R), not the network-facing, no-interaction 10.0 score supplied in the source feed. Publicly available exploit code exists (SSVC exploitation status 'poc', with a PoC repository referenced), the issue is rated fully automatable with total technical impact, and no CISA KEV listing was provided - so this is a proof-of-concept-stage risk rather than confirmed active exploitation.
Arbitrary code execution in Adobe Dimension 4.1.8 and earlier occurs through a CWE-426 untrusted search path flaw where a local attacker can pre-stage a malicious DLL or shared library in a directory the application searches ahead of the trusted location, which is then loaded when a victim launches Dimension. Exploitation requires local file-write access and user interaction, and no public exploit or CISA KEV listing has been identified at time of analysis. The vendor CVSS base score is 8.6 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), indicating high impact despite the local and interaction prerequisites.
Local privilege escalation in the Windows Setup Files Cleanup component allows an authenticated, low-privileged attacker to run code with elevated (SYSTEM) rights by planting a malicious binary in a directory that the cleanup routine searches ahead of its trusted location. Microsoft rates the flaw 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and the high attack complexity limits reliable exploitation to hosts where the attacker already controls a suitable search-path directory or can win a timing window; no public exploit identified at time of analysis, and CISA's SSVC assessment records no observed exploitation. Affected builds cover Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025, for which Microsoft has released fixed builds.
Local privilege escalation in the Windows Servicing Stack (SSU) allows an authenticated, low-privileged attacker who already holds a foothold on the host to write a malicious file into a directory the servicing component searches before the legitimate path, yielding SYSTEM-level code execution. The flaw spans the entire supported Windows range - Windows 10 1607/1809/21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025, including Server Core installations - with exploitation requiring only local access and write permission (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and non-automatable, and Microsoft has released fixes, so this is a credible but not emergency-level priority rather than an active threat.
Local privilege escalation in the Windows Update Service allows an authenticated, low-privileged user on Windows 11 (23H2, 24H2, 25H2, 26H1 and 26H2) or Windows Server 2025 to run code as SYSTEM by placing a malicious module in a directory the service searches ahead of the trusted location (CWE-426 untrusted search path, CVSS 7.8, vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not remote: an attacker must already hold a local authenticated account with write access to a directory in the service's search order, and CISA's SSVC assessment records exploitation as none, automatable as no and technical impact as total, making this a manual post-compromise escalation rather than a self-propagating or wormable issue. No public exploit code was identified at time of analysis, and Microsoft has published fixing updates through its MSRC Update Guide.
Local privilege escalation in the Windows Update component affects Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 (including Server Core installations) running builds prior to the vendor-patched levels. An attacker who already holds authenticated, low-privileged local code execution and can write a file into a directory that Windows Update searches ahead of its trusted location can plant a malicious binary that the service loads, yielding code execution at higher privilege with full impact to confidentiality, integrity and availability (CVSS 3.1: 7.8). The prerequisite local foothold and directory write access limit exposure, and no public exploit identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and the issue as non-automatable. Microsoft has released fixes in its update guide, so fully patched systems are not exploitable.
Local privilege escalation in the Windows Update component allows an authenticated, low-privileged user who already holds a foothold on the host to gain SYSTEM-level code execution by planting a malicious DLL or executable in a directory consulted through an untrusted search path (CWE-426). Only specific pre-patch builds are affected: Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2, plus Windows Server 2025 (including Server Core installations). Per the available intelligence this is not known to be actively exploited (no CISA KEV listing, SSVC exploitation value 'none') and no public exploit code has been identified at time of analysis; the EPSS signal is not provided, and the prerequisite local account and writable search-path location confine this to post-compromise escalation rather than initial access, making it a genuine but second-tier priority.
Arbitrary code execution on Windows in draw.io Desktop 31.4.5 and earlier stems from the Electron shell launching `powershell` and `attrib` by bare executable name, letting Windows resolve a same-named file from the diagram's own folder instead of System32. Exploitation requires the victim to extract an attacker-supplied archive and cold-open its legitimate `.drawio` file from that directory (the app must not already be running), with the powershell path firing when Local Fonts are enabled and the attrib path firing when draft or backup attributes are updated. The advisory publishes manual reproduction steps, so a public PoC reference exists; it is not verified as working exploit code, and there is no KEV entry or active-exploitation signal. Version 31.5.2 fixes the issue by invoking system binaries via absolute System32 paths, switching to `execFile`, and setting `NoDefaultCurrentDirectoryInExePath`; CVSS is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Authenticated users of pgAdmin 4 in server (multi-user web) mode can achieve arbitrary code execution as the operating-system account running pgAdmin by uploading an executable into a shared-storage directory and then pointing their own utility binary-path preference at it. The flaw affects releases before 9.19: the preference validator refused paths under the per-user STORAGE_DIR but never checked the SHARED_STORAGE directories that ordinary users can write to, so pg_dump, pg_restore, pg_dumpall or psql were launched from an attacker-controlled file. Practical exploitation is gated: the attacker needs a valid pgAdmin account and at least one non-restricted shared storage directory, and it is decisive on Windows server mode, where a file with an executable name runs, whereas on POSIX files created through pgAdmin are not executable - no public exploit was identified at time of analysis, and the CVSS 4.0 base of 7.7 (assessed as CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects those prerequisites rather than a network-wide, unauthenticated attack.
Local privilege escalation in Veeam Agent for Linux 13.1 allows a local low-privileged user to gain elevated privileges on hosts whose agent installation is managed by a Veeam Backup & Replication instance; standalone/unmanaged deployments are not affected. The flaw is an untrusted search path (CWE-426), the vendor has released a fix in 13.1.2, and no public exploit identified at time of analysis. This is a genuine but moderate-priority issue rather than an emergency.
Arbitrary code execution in DeepSeek Harness (dsh) at commit c291e796 stems from an untrusted search path weakness, letting an attacker plant a crafted executable in a location dsh consults when resolving content, so that the malicious file is run in place of the legitimate one. Exploitation is not automatic: per our independent assessment the attacker first needs write access to a searched directory (or control of a shared/current working directory) and then must induce a victim to open or run the substituted content, so the realistic vector is local with user interaction (AV:L/UI:R), not the network-facing, no-interaction 10.0 score supplied in the source feed. Publicly available exploit code exists (SSVC exploitation status 'poc', with a PoC repository referenced), the issue is rated fully automatable with total technical impact, and no CISA KEV listing was provided - so this is a proof-of-concept-stage risk rather than confirmed active exploitation.
Arbitrary code execution in Adobe Dimension 4.1.8 and earlier occurs through a CWE-426 untrusted search path flaw where a local attacker can pre-stage a malicious DLL or shared library in a directory the application searches ahead of the trusted location, which is then loaded when a victim launches Dimension. Exploitation requires local file-write access and user interaction, and no public exploit or CISA KEV listing has been identified at time of analysis. The vendor CVSS base score is 8.6 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), indicating high impact despite the local and interaction prerequisites.
Local privilege escalation in the Windows Setup Files Cleanup component allows an authenticated, low-privileged attacker to run code with elevated (SYSTEM) rights by planting a malicious binary in a directory that the cleanup routine searches ahead of its trusted location. Microsoft rates the flaw 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and the high attack complexity limits reliable exploitation to hosts where the attacker already controls a suitable search-path directory or can win a timing window; no public exploit identified at time of analysis, and CISA's SSVC assessment records no observed exploitation. Affected builds cover Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025, for which Microsoft has released fixed builds.
Local privilege escalation in the Windows Servicing Stack (SSU) allows an authenticated, low-privileged attacker who already holds a foothold on the host to write a malicious file into a directory the servicing component searches before the legitimate path, yielding SYSTEM-level code execution. The flaw spans the entire supported Windows range - Windows 10 1607/1809/21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025, including Server Core installations - with exploitation requiring only local access and write permission (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and non-automatable, and Microsoft has released fixes, so this is a credible but not emergency-level priority rather than an active threat.
Local privilege escalation in the Windows Update Service allows an authenticated, low-privileged user on Windows 11 (23H2, 24H2, 25H2, 26H1 and 26H2) or Windows Server 2025 to run code as SYSTEM by placing a malicious module in a directory the service searches ahead of the trusted location (CWE-426 untrusted search path, CVSS 7.8, vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not remote: an attacker must already hold a local authenticated account with write access to a directory in the service's search order, and CISA's SSVC assessment records exploitation as none, automatable as no and technical impact as total, making this a manual post-compromise escalation rather than a self-propagating or wormable issue. No public exploit code was identified at time of analysis, and Microsoft has published fixing updates through its MSRC Update Guide.
Local privilege escalation in the Windows Update component affects Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 (including Server Core installations) running builds prior to the vendor-patched levels. An attacker who already holds authenticated, low-privileged local code execution and can write a file into a directory that Windows Update searches ahead of its trusted location can plant a malicious binary that the service loads, yielding code execution at higher privilege with full impact to confidentiality, integrity and availability (CVSS 3.1: 7.8). The prerequisite local foothold and directory write access limit exposure, and no public exploit identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and the issue as non-automatable. Microsoft has released fixes in its update guide, so fully patched systems are not exploitable.
Local privilege escalation in the Windows Update component allows an authenticated, low-privileged user who already holds a foothold on the host to gain SYSTEM-level code execution by planting a malicious DLL or executable in a directory consulted through an untrusted search path (CWE-426). Only specific pre-patch builds are affected: Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2, plus Windows Server 2025 (including Server Core installations). Per the available intelligence this is not known to be actively exploited (no CISA KEV listing, SSVC exploitation value 'none') and no public exploit code has been identified at time of analysis; the EPSS signal is not provided, and the prerequisite local account and writable search-path location confine this to post-compromise escalation rather than initial access, making it a genuine but second-tier priority.